Buffer overflow in xloadimage 4.1 and earlier, and xli, might allow user-assisted attackers to execute arbitrary code via a long title name in a NIFF file, which triggers the overflow during (1) zoom, (2) reduce, or (3) rotate operations.

A new xloadimage package that fixes bugs in handling malformed tiff and pbm/pnm/ppm images, and in handling metacharacters in file names is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The xloadimage utility displays images in an X Window System window, loads images into the root window, or writes images into a file.
Xloadimage supports many image types (including GIF, TIFF, JPEG, XPM, and XBM).

A flaw was discovered in xloadimage via which an attacker can construct a NIFF image with a very long embedded image title. This image can cause a buffer overflow. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-3178 to this issue.

All users of xloadimage should upgrade to this erratum package, which contains backported patches to correct these issues.

Ariel Berkman reports :

Unlike most of the supported image formats in xloadimage, the NIFF image format can store a title name of arbitrary length as part of the image file.

When xloadimage is processing a loaded image, it is creating a new Image object and then writing the processed image to it. At that point, it will also copy the title from the old image to the newly created image.

The 'zoom', 'reduce', and 'rotate' functions are using a fixed length buffer to construct the new title name when an image processing is done. Since the title name in a NIFF format is of varying length, and there are insufficient buffer size validations, the buffer can be overflowed.

The remote host is affected by the vulnerability described in GLSA-200510-26 (XLI, Xloadimage: Buffer overflow)

    When XLI or Xloadimage process an image, they create a new image     object to contain the new image, copying the title from the old image     to the newly created image. Ariel Berkman reported that the 'zoom',     'reduce', and 'rotate' functions use a fixed length buffer to contain     the new title, which could be overwritten by the NIFF or XPM image     processors.
  Impact :

    A malicious user could craft a malicious XPM or NIFF file and     entice a user to view it using XLI, or manipulate it using Xloadimage,     potentially resulting in the execution of arbitrary code with the     permissions of the user running XLI or Xloadimage.
  Workaround :

    There is no known workaround at this time.

Ariel Berkman discovered several buffer overflows in xloadimage, which are also present in xli, a command line utility for viewing images in X11, and could be exploited via large image titles and cause the execution of arbitrary code.

The updated packages have been patched to address this issue.

Ariel Berkman discovered several buffer overflows in xloadimage, which are also present in xli, a command line utility for viewing images in X11, and could be exploited via large image titles and cause the execution of arbitrary code.

Ariel Berkman discovered several buffer overflows in xloadimage, a graphics file viewer for X11, that can be exploited via large image titles and cause the execution of arbitrary code.

ID	Name	Product	Family	Severity
21862	CentOS 3 / 4 : xloadimage (CESA-2005:802)	Nessus	CentOS Local Security Checks	medium
21409	FreeBSD : xloadimage -- buffer overflows in NIFF image title handling (2f0cb4bb-416d-11da-99fe-000854d03344)	Nessus	FreeBSD Local Security Checks	medium
21275	GLSA-200510-26 : XLI, Xloadimage: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
20434	Mandrake Linux Security Advisory : xli (MDKSA-2005:192)	Nessus	Mandriva Local Security Checks	medium
20060	RHEL 2.1 / 3 / 4 : xloadimage (RHSA-2005:802)	Nessus	Red Hat Local Security Checks	medium
19967	Debian DSA-859-1 : xli - buffer overflows	Nessus	Debian Local Security Checks	medium
19966	Debian DSA-858-1 : xloadimage - buffer overflows	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2005-3178

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium